CVE-2026-27878: Grafana Tempo

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

Affected products

• Grafana Tempo: from 2.6.0, before 2.8.4 (fixed in 2.8.4); from 2.9.0, before 2.9.2 (fixed in 2.9.2); from 2.10.0, before 2.10.2 (fixed in 2.10.2)

Published 2026-06-19. Last modified 2026-06-29.